Lines Matching refs:hctx
215 handler_ctx_free (handler_ctx *hctx) in handler_ctx_free() argument
217 if (hctx->ssl) SSL_free(hctx->ssl); in handler_ctx_free()
218 free(hctx); in handler_ctx_free()
338 EVP_CIPHER_CTX *ctx, HMAC_CTX *hctx, int enc) in ssl_tlsext_ticket_key_cb() argument
349 HMAC_Init_ex(hctx, k->tick_hmac_key, sizeof(k->tick_hmac_key), in ssl_tlsext_ticket_key_cb()
358 HMAC_Init_ex(hctx, k->tick_hmac_key, sizeof(k->tick_hmac_key), in ssl_tlsext_ticket_key_cb()
458 handler_ctx *hctx = (handler_ctx *) SSL_get_app_data(ssl); in ssl_tlsext_status_cb() local
459 if (NULL == hctx->conf.pc) return SSL_TLSEXT_ERR_NOACK;/*should not happen*/ in ssl_tlsext_status_cb()
460 buffer *ssl_stapling = hctx->conf.pc->ssl_stapling; in ssl_tlsext_status_cb()
473 log_error(hctx->r->conf.errh, __FILE__, __LINE__, in ssl_tlsext_status_cb()
475 hctx->r->uri.authority.ptr, ERR_error_string(ERR_get_error(), NULL)); in ssl_tlsext_status_cb()
1134 handler_ctx *hctx = (handler_ctx *) SSL_get_app_data(ssl); in ssl_info_callback() local
1135 if (hctx->renegotiations >= 0) ++hctx->renegotiations; in ssl_info_callback()
1146 handler_ctx *hctx = (handler_ctx *) SSL_get_app_data(ssl); in ssl_info_callback() local
1147 hctx->renegotiations = -1; in ssl_info_callback()
1160 handler_ctx *hctx; in verify_callback() local
1170 hctx = (handler_ctx *) SSL_get_app_data(ssl); in verify_callback()
1181 if (depth > hctx->conf.ssl_verifyclient_depth) { in verify_callback()
1187 if (preverify_ok && 0 == depth && NULL != hctx->conf.ssl_ca_dn_file) { in verify_callback()
1190 STACK_OF(X509_NAME) * const cert_names = hctx->conf.ssl_ca_dn_file; in verify_callback()
1193 if (NULL == err_cert) return !hctx->conf.ssl_verifyclient_enforce; in verify_callback()
1216 if (NULL == err_cert) return !hctx->conf.ssl_verifyclient_enforce; in verify_callback()
1218 log_error_st *errh = hctx->r->conf.errh; in verify_callback()
1233 return !hctx->conf.ssl_verifyclient_enforce; in verify_callback()
1239 handler_ctx *hctx = (handler_ctx *) SSL_get_app_data(ssl); in mod_openssl_cert_cb() local
1240 plugin_cert *pc = hctx->conf.pc; in mod_openssl_cert_cb()
1246 log_error(hctx->r->conf.errh, __FILE__, __LINE__, in mod_openssl_cert_cb()
1249 hctx->r->uri.authority.ptr); in mod_openssl_cert_cb()
1258 log_error(hctx->r->conf.errh, __FILE__, __LINE__, in mod_openssl_cert_cb()
1260 hctx->r->uri.authority.ptr, ERR_error_string(ERR_get_error(), NULL)); in mod_openssl_cert_cb()
1268 log_error(hctx->r->conf.errh, __FILE__, __LINE__, in mod_openssl_cert_cb()
1270 hctx->r->uri.authority.ptr, ERR_error_string(ERR_get_error(), NULL)); in mod_openssl_cert_cb()
1274 if (hctx->conf.ssl_verifyclient) { in mod_openssl_cert_cb()
1275 if (NULL == hctx->conf.ssl_ca_file) { in mod_openssl_cert_cb()
1276 log_error(hctx->r->conf.errh, __FILE__, __LINE__, in mod_openssl_cert_cb()
1278 "for TLS server name %s", hctx->r->uri.authority.ptr); in mod_openssl_cert_cb()
1284 if (hctx->conf.ssl_verifyclient_enforce) in mod_openssl_cert_cb()
1287 wolfSSL_set_verify_depth(ssl, hctx->conf.ssl_verifyclient_depth + 1); in mod_openssl_cert_cb()
1306 mod_openssl_SNI (handler_ctx *hctx, const char *servername, size_t len) in mod_openssl_SNI() argument
1308 request_st * const r = hctx->r; in mod_openssl_SNI()
1327 mod_openssl_patch_config(r, &hctx->conf); in mod_openssl_SNI()
1333 return (mod_openssl_cert_cb(hctx->ssl, NULL) == 1) in mod_openssl_SNI()
1341 handler_ctx *hctx = (handler_ctx *) SSL_get_app_data(ssl); in network_ssl_servername_callback() local
1346 if (hctx->alpn == MOD_OPENSSL_ALPN_ACME_TLS_1) in network_ssl_servername_callback()
1350 if (hctx->r->conditional_is_valid & (1 << COMP_HTTP_HOST))/*(already done)*/ in network_ssl_servername_callback()
1352 buffer_copy_string_len(&hctx->r->uri.scheme, CONST_STR_LEN("https")); in network_ssl_servername_callback()
1366 int read_ahead = hctx->conf.ssl_read_ahead; in network_ssl_servername_callback()
1367 int rc = mod_openssl_SNI(hctx, servername, len); in network_ssl_servername_callback()
1368 if (!read_ahead && hctx->conf.ssl_read_ahead) in network_ssl_servername_callback()
1369 SSL_set_read_ahead(ssl, hctx->conf.ssl_read_ahead); in network_ssl_servername_callback()
1372 return mod_openssl_SNI(hctx, servername, len); in network_ssl_servername_callback()
1705 mod_openssl_acme_tls_1 (SSL *ssl, handler_ctx *hctx) in mod_openssl_acme_tls_1() argument
1707 buffer * const b = hctx->tmp_buf; in mod_openssl_acme_tls_1()
1708 const buffer * const name = &hctx->r->uri.authority; in mod_openssl_acme_tls_1()
1709 log_error_st * const errh = hctx->r->conf.errh; in mod_openssl_acme_tls_1()
1717 if (!hctx->conf.ssl_acme_tls_1) in mod_openssl_acme_tls_1()
1727 if (0 != http_request_host_policy(name,hctx->r->conf.http_parseopts,443)) in mod_openssl_acme_tls_1()
1730 buffer_copy_path_len2(b, BUF_PTR_LEN(hctx->conf.ssl_acme_tls_1), in mod_openssl_acme_tls_1()
1791 hctx->conf.ssl_verifyclient_enforce = 0; in mod_openssl_acme_tls_1()
1807 mod_openssl_alpn_h2_policy (handler_ctx * const hctx) in mod_openssl_alpn_h2_policy() argument
1811 if (buffer_is_blank(&hctx->r->uri.authority)) { in mod_openssl_alpn_h2_policy()
1812 log_error(hctx->errh, __FILE__, __LINE__, in mod_openssl_alpn_h2_policy()
1817 if (wolfSSL_version(hctx->ssl) < TLS1_2_VERSION) { in mod_openssl_alpn_h2_policy()
1818 log_error(hctx->errh, __FILE__, __LINE__, in mod_openssl_alpn_h2_policy()
1830 handler_ctx *hctx = (handler_ctx *) SSL_get_app_data(ssl); in mod_openssl_alpn_select_cb() local
1840 if (!hctx->r->conf.h2proto) continue; in mod_openssl_alpn_select_cb()
1842 if (hctx->r->handler_module == NULL)/*(e.g. not mod_sockproxy)*/ in mod_openssl_alpn_select_cb()
1843 hctx->r->http_version = HTTP_VERSION_2; in mod_openssl_alpn_select_cb()
1861 int rc = mod_openssl_acme_tls_1(ssl, hctx); in mod_openssl_alpn_select_cb()
1875 hctx->alpn = proto; in mod_openssl_alpn_select_cb()
2728 mod_openssl_close_notify(handler_ctx *hctx);
2734 handler_ctx * const hctx = con->plugin_ctx[plugin_data_singleton->id]; in connection_write_cq_ssl() local
2735 SSL * const ssl = hctx->ssl; in connection_write_cq_ssl()
2736 log_error_st * const errh = hctx->errh; in connection_write_cq_ssl()
2738 if (__builtin_expect( (0 != hctx->close_notify), 0)) in connection_write_cq_ssl()
2739 return mod_openssl_close_notify(hctx); in connection_write_cq_ssl()
2766 if (__builtin_expect( (hctx->renegotiations > 1), 0)) { in connection_write_cq_ssl()
2837 handler_ctx * const hctx = con->plugin_ctx[plugin_data_singleton->id]; in connection_read_cq_ssl() local
2844 if (__builtin_expect( (0 != hctx->close_notify), 0)) in connection_read_cq_ssl()
2845 return mod_openssl_close_notify(hctx); in connection_read_cq_ssl()
2849 len = SSL_pending(hctx->ssl); in connection_read_cq_ssl()
2854 len = SSL_read(hctx->ssl, mem, mem_len); in connection_read_cq_ssl()
2857 if (hctx->renegotiations > 1) { in connection_read_cq_ssl()
2858 log_error(hctx->errh, __FILE__, __LINE__, in connection_read_cq_ssl()
2865 if (hctx->alpn) { in connection_read_cq_ssl()
2866 if (hctx->alpn == MOD_OPENSSL_ALPN_H2) { in connection_read_cq_ssl()
2867 if (0 != mod_openssl_alpn_h2_policy(hctx)) in connection_read_cq_ssl()
2870 else if (hctx->alpn == MOD_OPENSSL_ALPN_ACME_TLS_1) { in connection_read_cq_ssl()
2875 if (1 == SSL_do_handshake(hctx->ssl)) return -1; in connection_read_cq_ssl()
2879 hctx->alpn = 0; in connection_read_cq_ssl()
2884 && (hctx->conf.ssl_read_ahead || SSL_pending(hctx->ssl) > 0)); in connection_read_cq_ssl()
2889 switch ((rc = SSL_get_error(hctx->ssl, len))) { in connection_read_cq_ssl()
2918 log_error(hctx->errh, __FILE__, __LINE__, in connection_read_cq_ssl()
2924 if (!hctx->conf.ssl_log_noise) break; in connection_read_cq_ssl()
2932 if (0==oerrno && 0==cq->bytes_in && !hctx->conf.ssl_log_noise) in connection_read_cq_ssl()
2936 log_perror(hctx->errh, __FILE__, __LINE__, in connection_read_cq_ssl()
2970 if (!hctx->conf.ssl_log_noise) continue; in connection_read_cq_ssl()
2976 log_error(hctx->errh, __FILE__, __LINE__, in connection_read_cq_ssl()
2999 handler_ctx * const hctx = handler_ctx_init(); in CONNECTION_FUNC() local
3001 hctx->r = r; in CONNECTION_FUNC()
3002 hctx->con = con; in CONNECTION_FUNC()
3003 hctx->tmp_buf = con->srv->tmp_buf; in CONNECTION_FUNC()
3004 hctx->errh = r->conf.errh; in CONNECTION_FUNC()
3005 con->plugin_ctx[p->id] = hctx; in CONNECTION_FUNC()
3009 hctx->ssl = SSL_new(s->ssl_ctx); in CONNECTION_FUNC()
3010 if (NULL != hctx->ssl in CONNECTION_FUNC()
3011 && SSL_set_app_data(hctx->ssl, hctx) in CONNECTION_FUNC()
3012 && SSL_set_fd(hctx->ssl, con->fd)) { in CONNECTION_FUNC()
3013 SSL_set_accept_state(hctx->ssl); in CONNECTION_FUNC()
3017 mod_openssl_patch_config(r, &hctx->conf); in CONNECTION_FUNC()
3029 mod_openssl_detach(handler_ctx *hctx) in mod_openssl_detach() argument
3034 hctx->con->is_ssl_sock = 0; in mod_openssl_detach()
3036 if (-1 == hctx->close_notify) shutdown(hctx->con->fd, SHUT_WR); in mod_openssl_detach()
3037 hctx->close_notify = 1; in mod_openssl_detach()
3044 handler_ctx *hctx = con->plugin_ctx[p->id]; in CONNECTION_FUNC() local
3045 if (NULL == hctx) return HANDLER_GO_ON; in CONNECTION_FUNC()
3047 hctx->close_notify = -2; in CONNECTION_FUNC()
3048 if (SSL_is_init_finished(hctx->ssl)) { in CONNECTION_FUNC()
3049 mod_openssl_close_notify(hctx); in CONNECTION_FUNC()
3052 mod_openssl_detach(hctx); in CONNECTION_FUNC()
3060 mod_openssl_close_notify(handler_ctx *hctx) in mod_openssl_close_notify() argument
3066 if (1 == hctx->close_notify) return -2; in mod_openssl_close_notify()
3069 switch ((ret = SSL_shutdown(hctx->ssl))) { in mod_openssl_close_notify()
3071 mod_openssl_detach(hctx); in mod_openssl_close_notify()
3095 ssl_r = SSL_pending(hctx->ssl); in mod_openssl_close_notify()
3099 ret = SSL_read(hctx->ssl, buf, (int)sizeof(buf)); in mod_openssl_close_notify()
3100 } while (ret > 0 && (hctx->conf.ssl_read_ahead||(ssl_r-=ret))); in mod_openssl_close_notify()
3104 switch ((ret = SSL_shutdown(hctx->ssl))) { in mod_openssl_close_notify()
3106 mod_openssl_detach(hctx); in mod_openssl_close_notify()
3109 hctx->close_notify = -1; in mod_openssl_close_notify()
3118 if (!SSL_is_init_finished(hctx->ssl)) { in mod_openssl_close_notify()
3119 mod_openssl_detach(hctx); in mod_openssl_close_notify()
3123 switch ((ssl_r = SSL_get_error(hctx->ssl, ret))) { in mod_openssl_close_notify()
3127 hctx->close_notify = -1; in mod_openssl_close_notify()
3135 mod_openssl_detach(hctx); in mod_openssl_close_notify()
3138 log_perror(hctx->r->conf.errh, __FILE__, __LINE__, in mod_openssl_close_notify()
3146 errh = hctx->r->conf.errh; in mod_openssl_close_notify()
3156 hctx->close_notify = -1; in mod_openssl_close_notify()
3164 handler_ctx *hctx = con->plugin_ctx[p->id]; in CONNECTION_FUNC() local
3165 if (NULL != hctx) { in CONNECTION_FUNC()
3167 handler_ctx_free(hctx); in CONNECTION_FUNC()
3222 https_add_ssl_client_entries (request_st * const r, handler_ctx * const hctx) in https_add_ssl_client_entries() argument
3228 long vr = SSL_get_verify_result(hctx->ssl); in https_add_ssl_client_entries()
3233 } else if (!(xs = SSL_get_peer_certificate(hctx->ssl))) { in https_add_ssl_client_entries()
3264 if (hctx->conf.ssl_verifyclient_username) { in https_add_ssl_client_entries()
3270 const buffer *varname = hctx->conf.ssl_verifyclient_username; in https_add_ssl_client_entries()
3282 if (hctx->conf.ssl_verifyclient_export_cert) { in https_add_ssl_client_entries()
3299 http_cgi_ssl_env (request_st * const r, handler_ctx * const hctx) in http_cgi_ssl_env() argument
3304 s = SSL_get_version(hctx->ssl); in http_cgi_ssl_env()
3307 if ((cipher = SSL_get_current_cipher(hctx->ssl))) { in http_cgi_ssl_env()
3334 handler_ctx *hctx = r->con->plugin_ctx[p->id]; in REQUEST_FUNC() local
3335 if (NULL == hctx) return HANDLER_GO_ON; in REQUEST_FUNC()
3338 http_cgi_ssl_env(r, hctx); in REQUEST_FUNC()
3339 if (hctx->conf.ssl_verifyclient) { in REQUEST_FUNC()
3340 https_add_ssl_client_entries(r, hctx); in REQUEST_FUNC()
3357 handler_ctx *hctx = r->con->plugin_ctx[p->id]; in REQUEST_FUNC() local
3358 if (NULL == hctx) return HANDLER_GO_ON; in REQUEST_FUNC()
3360 mod_openssl_patch_config(r, &hctx->conf); in REQUEST_FUNC()
3361 if (hctx->conf.ssl_verifyclient) { in REQUEST_FUNC()